The Watchtower

Are we building enterprise AI backwards? As organizations race to adopt bigger, more powerful AI models, Alex Attumalil, Global CISO at Under Armour, believes the real transformation may come from thinking smaller. In this episode of The Watchtower, Alex joins Ash Hunt to explore why general-purpose LLMs aren't enough to transform complex business processes, how smaller, specialized AI models could reshape the enterprise, and why business leaders, rather than technology teams, should be driving AI adoption. They also examine how AI is changing cybersecurity itself. From sophisticated phishing attacks that are forcing organizations to rethink decades of security training to AI-powered security operations that can deliver faster, more consistent decisions, Alex shares how security leaders must adapt to a rapidly changing threat landscape. And as automation continues to evolve, what happens when AI can identify software vulnerabilities before they ever reach production?  ConnectAlex Attumalil on LinkedIn Under Armour Ash Hunt on LinkedIn The Watchtower   Learn MoredatasecAI by Cyera   Chapters0:00 One giant brain, or lots of small ones?1:18 Meet Alex Attumalil, Global CISO at Under Armour2:19 The two-front war: defending AI, and defending against AI4:47 The decade of phishing training that just became obsolete7:32 Running security consistently across a global business10:38 The only SecOps metric that matters: time to action15:32 'Democratizing the response' — AI's hidden payoff16:53 Why your tech team is the wrong owner for AI22:44 The micro-LLM thesis: enterprise AI as microservices24:53 Repatriation: bringing tuned AI back into the data center25:30 Why LLMs keep giving you different answers28:14 SLMs are quietly beating LLMs in the enterprise30:52 Where the CISO role goes next34:44 Could software ever have no vulnerabilities?37:05 Every enterprise does two things. The rest is scaffolding. Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

If Convenience Wins, We Lose. Evan Gordenker led more than 160 insider investigations at Unit 42, including work on DPRK IT-worker operations, before taking over insider threat and data security at Airwallex. Evan joins Ash Hunt to showcase how intent is often the wrong place to start. Whether the risk comes from an employee, an AI agent, or an adversary using legitimate credentials, the real question is what trusted access allows them to do. Evan explains why convenience sits at the center of human and agentic risk, how AI agents expose the limits of access models built for people, why security teams need finer-grained control over credentials and permissions, and why the DPRK IT-worker playbook keeps working without changing much at all.  ConnectEvan Gordenker on LinkedIn Airwallex   Chapters0:00 The insider threat you're worried about isn't a person1:19 How Evan fell into cybersecurity via the Tokyo Olympics4:20 What the industry gets wrong about who the insider actually is5:25 Why the 'secret police' framing kills your program8:00 Intent doesn't matter — controls do9:30 What a real, messy insider investigation actually looks like12:30 One sentence in an incident report can end a career15:01 Would you classify an AI agent as an insider?16:33 The one-password experiment — how agents test every credential19:39 4 years into agentic systems. Still built for humans only.23:54 If security runs insider risk alone, you're toast28:35 The DPRK IT-worker threat — and why it hasn't had to evolve32:54 How Fortune 500s started frustrating North Korean operators36:48 The one through-line: convenience42:50 Why InfoSec has never mattered more than right now Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Should detection and response remain the center of security when AI, data, and identity are converging at machine speed? Detection and response has long been an organizing principle of enterprise security. Francis Odum, Founder and CEO of Software Analyst Cyber Research, argues that model is being pushed to its limits as AI agents act autonomously and attack timelines compress. In this episode, Francis and Ash Hunt explore why existing identity controls may not be enough for AI agents, why every AI security vendor sounds identical right now, and how security controls have to change for agentic systems.    ConnectFrancis Odum on LinkedIn Software Analyst Cyber Research Ash Hunt on LinkedIn   Chapters0:00 Can Human-Speed Security Stop Machine-Speed Threats?1:15 Francis Odum on What's Changing in Cybersecurity3:53 Cybersecurity Was Built for Humans — Not Agents8:44 Why Every AI Security Vendor Sounds the Same11:08 Why Platforms May Win the AI Security Race14:31 What Happened to the First Wave of AI Security Startups19:20 Why Non-Human Identities Were a "Head Fake"22:00 Should AI Agents Have Their Own Identity?25:58 The Authorization Problem AI Agents Create28:29 What Hugging Face Revealed About Agent Controls32:15 Can Detection and Response Keep Up With AI?34:27 How AI Makes Attacks Faster and Cheaper36:02 Why Security Has to Become More Preemptive41:03 The New Agentic Supply Chain Risk43:27 Why Agentic Failures May Not Look Like Cyberattacks45:13 What SACR Is Researching Next   Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

If you focus entirely on the external AI-fraud threat, you're going to get burned by what's already inside your organization. AI is making external fraud more convincing - deepfake CEOs on service-desk calls, synthetic video, generative BEC. But the same tools also scale internal fraud, from fake invoices and fabricated expenses to ghost employees. Mason Wilder, Research Director at the Association of Certified Fraud Examiners, joins Ash Hunt to unpack why it's never been easier to commit fraud, how organized crime is changing the landscape, and why the old walls between cybersecurity, fraud, and AML are starting to break down - and where companies should actually be investing to keep up. Connect Mason Wilder on LinkedIn ACFE ACFE Anti-Fraud Technology Benchmarking Report ACFE Report to the Nations Chapters 0:00 The AI Fraud Threat Inside Your Company 1:03 From Overnight SOC Shifts to the ACFE 2:56 Why Fraud Has Never Been Easier 4:55 What the 2026 AI-Fraud Survey Revealed 5:25 Why Only 7% Feel Prepared for AI-Powered Fraud 6:12 Why Cyber, Fraud, and AML Can't Stay Siloed 9:33 How Deepfake Fraud Started in 2018 11:54 From Social Engineering to Automated Attacks 13:41 Where Companies Should Invest Against AI Fraud 16:53 The Internal Fraud Risk Getting Overlooked 20:00 Why Internal Fraud Doesn't Go Away 22:52 Why Tips Still Catch 43% of Fraud 26:18 Turning Employees Into a Fraud Detection Layer 28:17 What Agent-to-Agent Fraud Changes 34:59 How Singapore Is Shifting Fraud Liability 37:11 What Deepfake Detection Really Looks Like 42:24 Why Cyber and Fraud Are Ultimately on the Same Team Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

When security deals in absolutes, the business finds a way around it. Bose CISO Arun Abraham joins Ash Hunt to discuss why flat “no”s create shadow IT, how security leaders can enable AI without opening the gates, and why fundamentals like data, identity, vulnerability management, and risk prioritization still matter most.   Connect Arun Abraham on LinkedIn Bose Corporation The Watchtower   Chapters 0:00 Are We Too Secure? 1:25 The CISO outsider advantage 5:19 Puritanism in security 6:24 How to earn trust when you tell executives the truth 8:11 Why quantitative risk beats maturity curves 9:39 The three fundamentals: detect, respond, VM 13:44 What AI enablement requires from security 14:14 The cloud playbook applies: enable or get shadow AI 15:10 The CISO who got replaced for saying no 15:49 Why Bose's security team has a backlog 19:59 The five-minute aha moment 21:34 If you don't know where your data is, you can't enable AI 25:09 The internal AI agent that replaced policy 27:22 The secure SDLC didn't look like this five years ago 29:44 AI won't invent new attacks - it'll use your deficiencies 31:04 Perfect is the enemy of good Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Is security really failing or is it our Paleolithic brains?  It’s the 'responsibility-control paradox' eating CISOs alive Peter Coroneos is the founder of Cybermindz.org, former head of Australia's Internet Industry Association, and one of the few voices in cybersecurity trained in both law and neuroscience. In this episode he explains why we're running paleolithic brains inside a 21st-century attack surface, why the industry's definition of 'resilience' is quietly draining its best people, and why AI is about to accelerate burnout before it eases it.   Connect Peter Coroneos on LinkedIn Cybermindz.org The Watchtower   Chapters 0:00 Is security really failing? Or are our paleolithic brains? 2:07 The brain in a bucket: how it all started 3:41 From neuroscience to internet law to cyber policy 4:50 Why Peter started seeing burnout in his peers pre-COVID 8:28 Alert fatigue and vigilance decrement inside the SOC 11:31 Paleolithic brain, meet 21st-century attack surface 11:55 The signal your brain never gets: no cue to de-escalate 12:09 The responsibility-control paradox that breaks CISOs 14:23 Why your brain can't tell virtual threat from physical 16:52 Stress takes your prefrontal cortex offline 18:53 Why Cybermindz stopped talking about wellness 20:00 Burnout is a lagging indicator 28:24 What actually changes inside teams that get support 28:46 Stress you can sustain if you design in recovery 38:35 Your best analysts don't lose skills. They lose access. 41:17 The AI accelerant: why burnout is about to get worse 45:44 What CISOs should do before the gap opens up Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

How defense keeps up with AI, cyber threats, and private-sector innovation. In this episode of The Watchtower, Ash Hunt sits down with Jimmy Harrington, retired Air Force colonel and former Deputy CIO at U.S. Special Operations Command, for a conversation about cyber resilience, defense innovation, and what large organizations often misunderstand about speed. From NATO and the Pentagon to AI-enabled defense systems and private-sector collaboration, Jimmy shares what defense can teach enterprise security leaders about resilience, leadership, mentorship, and building organizations that can operate through uncertainty.   Highlights Why “keeping up” may be the wrong question How zero trust changes the goal from prevention to resilience Why defense innovation can become “innovation theater” What it takes for new technology to actually scale What CISOs can learn from military leadership and mentorship    Connect Jimmy Harrington on LinkedIn   Chapters 0:00 Can organizations keep up with innovation? 1:14 Jimmy Harrington Deputy CIO 5:36 The pace problem inside defense institutions 6:50 Reframing cyber success: stop trying to stop everything 8:49 Run fast, trip less - operating under uncertainty 12:12 Threat-agnostic vs threat-specific cyber defense 14:09 Defense tech: from leading edge to catching up 15:14 Innovation theater: the $5B that never scaled 18:55 Slow is smooth, smooth is fast 21:16 Palantir, Anduril, and selling belief to the DoD 24:33 Building the plane while it's flying 27:23 Why CISOs and defense leaders don't collaborate enough 31:34 The military's leadership DNA corporate lacks 35:49 Mentorship and the replacement-first model 41:24 How leaders are actually built 43:10 The hardest part of leaving the military 46:28 What corporate underestimates about veterans Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Is AI helping us make better decisions or just giving us more data to misinterpret? In this episode of The Watchtower, Ash Hunt speaks with Tony Martin-Vegue, founder of NinetyFive Risk Advisory and author of From Heat Maps to Histograms, about cyber risk, decision-making, and the role of AI in risk analysis. Tony explains why security teams often have more data than they realize, but still need the judgment to evaluate that data, understand its quality, and use it responsibly.   Highlights Why AI can supercharge risk analysis without replacing human judgment How LLM outputs should earn their way into a risk model Why red/yellow/green heat maps limit executive risk conversations How cyber risk quantification helps security leaders speak in business terms What cybersecurity can learn from meteorology, epidemiology, actuarial science, and financial risk management   Connect Tony Martin-Vegue on LinkedIn 95 Risk Advisory   Chapters 0:00 The judgment problem AI can't solve 1:24 From IT janitor to risk analyst with Tony Martin-Vegue 5:19 Explaining risk in dollars vs colors 9:35 Not enough data is not an excuse 13:50 The DBIR, data quality, and the 500-report flood 16:46 Industry reports or Twitter polls 17:39 Decision engineering: operating under uncertainty 20:35 The CISO's real job isn't stopping attacks 21:31 The most influential cybersecurity book 28:41 AI launders bias 31:49 Decision engineering at scale: agentic context across the business 39:43 Cyber risk math was invented by 18th-century gamblers 41:20 What cybersecurity needs to steal from other fields 43:44 Toyota, Taylorism, and why your heat map has to die 45:53 Where to find Tony and the book Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Identity is now the fabric that determines the viability of every business operation. In this episode of The Watchtower, Ash Hunt talks with Valvoline CISO Corey Kaemming about how identity became the operational backbone of modern companies. As cloud, automation, and AI accelerate, identity failures don’t just create risk - they stop work entirely. They explore why identity decisions are now business decisions, how automation amplifies identity risk, and why CISOs are evolving from gatekeepers into service leaders responsible for keeping operations moving.   Chapters 0:00 Identity Now Runs Everything (Corey Kaemming) 1:20 Why Identity Suddenly Matters More Than Ever 5:40 “Attackers Aren’t Breaking In… They’re Logging In” 9:30 Identity as the Backbone of Enterprise Operations 12:00 You Can’t Just “Turn On” AI in Security 17:00 Moving Beyond Passwords - What Users Actually Want 19:20 Why Identity Workflows Keep Breaking 23:10 When Identity Fails, the Business Stops 26:00 “If You Can’t Log In, Nothing Works” 29:10 Inside a Real Identity Transformation Program 34:50 Who Should Own Identity - Security or the Business? 41:30 Rethinking Hiring, Teams, and Identity Strategy 46:15 Identity Beyond Security Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Security runs on metrics, but do those metrics reflect real risk? In this episode of The Watchtower, Ash Hunt sits down with Wade Baker - co-founder of Cyentia Institute and longtime architect of the Verizon DBIR - to dismantle the cybersecurity metrics that feel right but consistently lead programs astray. They take down "average cost per breach," expose why MTTR makes security teams look great while 99% of their vulnerabilities sit untouched, and introduce the half-life metric that actually tracks risk. Plus: why metrics are weaponized more often than they're used, and how AI agents are (finally) democratizing rigorous risk quantification.   Key Takeaways: - Cost-per-data-record is a survey artifact — there's no linear correlation between breach cost and records lost - MTTR only measures the vulnerabilities you remediate — so you can post a great MTTR while ignoring 99% of your environment - Survival analysis / half-life is the better metric — it tracks burn-down against a defined finish line, not raw speed - Think like a general, not a sniper: zero vulnerabilities is the wrong objective; the right 80% is - Metrics are weaponized to justify budget more often than they're used to manage program effectiveness - You don't need a stats PhD — AI agents are democratizing rigorous risk modeling   Wade Baker on LinkedIn: https://www.linkedin.com/in/drwadebaker/ Cyentia Research: cyentia.com/research   Chapters 00:00 Are we measuring the right things? 01:18 Which cybersecurity metrics are most misunderstood 02:48 The psychology of measuring what's easy 04:20 "We've got to measure something" — and the trap that creates 05:30 The real problem: security doesn't agree what "good" looks like 07:40 Sniper vs general: the thinking style CISOs need 09:28 Doing security things vs achieving security goals 10:25 The $215-per-record myth — and why it won't die 12:13 Metrics as weapons: the real reason the number survives 14:31 The needle-in-the-haystack reality of real breaches 15:45 Risk quantification was solved decades ago — in other industries 17:24 The MTTR indictment: measuring only what you fix 18:48 Survival analysis and the half-life metric 21:07 Fixed-speed decay: metrics as decision engineering 23:57 Event landscape vs threat landscape 27:19 AI agents as scenario-analysis partners 30:05 Democratizing risk modeling without a stats PhD 31:13 What security leaders should actually measure 34:15 Your metrics are not your boss's metrics 36:07 Data storytelling: testing a metric's "so what?" 37:03 What's next from Cyentia Institute Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Are you just avoiding a breach? Or are you prepared for one? Dan Bowden is the Global CISO at Marsh - the world's largest insurance broker - where he protects 90,000+ employees across 130+ countries while simultaneously seeing how organizations are evaluated after cyber incidents. In this episode, Dan breaks down how regulation, insurance, and real breach data are changing the standard for what "prepared" actually means in 2026. Dan Bowden is a seasoned security leader with a background spanning military, healthcare, and banking before joining Marsh as joint Global CISO. Key takeaways: - Why the gap between governance documentation and crisis culture is where most organizations fail - How to properly engage your cyber insurance broker as a consultative security partner, not a checkbox - What Marsh's breach data actually shows about insured companies being targeted (spoiler: the myth is busted) - Why MFA in 2026 should be baseline - and what carriers are asking about next - How regulatory frameworks like NYDFS are shifting from descriptive to prescriptive requirements Guest: Dan Bowden, Global CISO, Marsh LinkedIn: https://www.linkedin.com/in/deltasbravo/   Chapters 0:00 Dan Bowden: Cybersecurity Is Not “Best Effort” 1:10 What a Global CISO Sees That Others Don’t 3:50 Why Companies Call Their Broker First During an Incident 5:03 What Real Incident Data Actually Teaches You 7:04 Rethinking Risk: Frequency vs Catastrophic Events 10:12 Why Cyber Risk Is Still Measured Wrong 11:39 Stop Letting the News Drive Your Security Strategy 14:32 Where Incident Response Actually Breaks Down 15:00 Governance vs Culture - What Really Happens in Crisis 18:03 How to Test Leadership Under Pressure 19:32 What Most Companies Get Wrong About Cyber Insurance 23:12 Cyber Insurance Is Bigger Than “Cyber” 24:11 Why Most Broker Relationships Fail 25:52 How Insurance Decisions Actually Get Made 27:53 Identity Is the Root of Most Attacks 29:46 MFA Is the Baseline - But Not the End 33:27 How Regulation Is Reshaping Security 37:52 Myth: Insurance Makes You a Target 41:31 The Future: Custom Cyber Insurance Models Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

We’ve spent billions on cybersecurity. Why are the problems the same? In the first episode of The Watchtower, Ash Hunt invites Jason Clark, CSO at Cyera, to dig into the hard truth that foundational security controls still fail in real environments. Together, they explore why identity and data remain unsolved, how rapidly changing enterprise tech has outpaced control design, and why AI is forcing the industry to rethink its entire foundation. This episode is made possible by Cyera. Chapters 0:00 Has Cybersecurity Failed? 1:22 Jason Clark - Security Built for Old Tech 2:48 Why Security Frameworks Keep Failing 4:58 The Pattern - We Can’t Keep Up - iPhone, Cloud, AI Adoption 7:47 Security Strategy Problem - No Data Visibility 10:02 Data and Identity Are Broken in Security 13:34 Identity Is a House of Cards 15:09 AI Will Break (or Fix) Cybersecurity 18:18 Rethinking Security - Systems and Data as Assets 20:39 Why Security Teams Clash with the Business 24:02 Why Risk Modeling Fails in Security 27:58 CISO Leadership Problem - No Business Influence 30:42 AI Adoption - Why Security Must Lead 33:17 The Future of Cybersecurity - Orchestrating Intelligence 34:07 Closing - What Comes Next   Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

The systems we rely on weren’t built for the world we’re running today. Welcome to The Watchtower. The cybersecurity podcast exploring how identity, data, and behavior now control whether a business runs - or stops. Hosted by former global CISO, Ash Hunt, The Watchtower pulls back the curtain on what’s actually happening behind dashboards - from fragile identity systems to the real impact of AI inside the business. New episodes coming soon.   Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.